[PATCH] kobject_uevent: fix OOB read in kobject_action_type()

[Hyeontaek Lim <jennystr233@gmail.com>]

kobject_action_type() matches a user-supplied action string against
the short "add"/"remove"/"change"/... literals in kobject_actions[]
using strncmp() with a length (count_first) derived from the size of
the user-supplied buffer (up to the first space, or the whole write).

strncmp() correctly stops comparing as soon as it hits a NUL byte in
either string, so a caller can make it report a "match" against a
short literal like "add" by embedding a NUL right after "add" in an
otherwise much longer buffer (e.g. write "add\0" followed by 391
bytes of arbitrary padding, with no space, so count_first stays at
the full write length).

The subsequent bounds check then indexes the matched literal at that
same, much larger offset:

    if (kobject_actions[action][count_first] != '\0')

which reads far past the end of the 4-byte "add" literal, into
whatever object happens to follow it in .rodata (observed to land
inside uevent_helper_sysctl_table on the reporter's build).

Fix this by checking the literal's real length against count_first
before doing the strncmp()/indexing at all, instead of trusting that
a strncmp() "match" implies the lengths agree.

Reported-by: syzbot+d164947c037324221043@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d164947c037324221043
Signed-off-by: Hyeontaek Lim <jennystr233@gmail.com>
---
 lib/kobject_uevent.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index xxxxxxx..xxxxxxx 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -78,10 +78,11 @@ static int kobject_action_type(const char *buf, size_t count,
 		count_first = count;

 	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
+		if (strlen(kobject_actions[action]) != count_first)
+			continue;
 		if (strncmp(kobject_actions[action], buf, count_first) != 0)
 			continue;
-		if (kobject_actions[action][count_first] != '\0')
-			continue;
 		if (args)
 			*args = args_start;
 		*type = action;